Tor Browser handles this, it treats `.onion` as a secure context.